Security audit fixes (C1-C2, H1-H3, M1-M9, L1-L3)#147

Open

rubenxyz wants to merge 17 commits into

Techiebutler:mainfrom

rubenxyz:feature/security-fixes

Commits on Jul 12, 2026

fix(auth): do not leak invite_token to non-admin callers (C1)
rubenxyz
committed
fix(share): enforce password session on public comment endpoints (C2)
rubenxyz
committed
fix(auth): stop auto-creating accounts from magic-code requests (H1)
rubenxyz
committed
fix(api): warn when docs are enabled in production; strip path from CORS origin (H2, M7)
rubenxyz
committed
fix(share): move share-link password to POST /share/{token}/verify (H3)
rubenxyz
committed
fix(auth): enforce password min/max length (8-72) (M1)
rubenxyz
committed
fix(users): validate avatar_url scope in PATCH /users/{id} (M4)
rubenxyz
committed
Revert "fix(users): validate avatar_url scope in PATCH /users/{id} (M4)"
rubenxyz
committed
fix(comments): attachment presign uses public endpoint + forces download (M5, M6)
rubenxyz
committed
fix(s3): drop public-read policy on processed/*; tighten bucket CORS (M2, L2)
rubenxyz
committed
fix(search): escape LIKE wildcards in user + asset + folder search (L1)
rubenxyz
committed
fix(auth): rate-limit /auth/refresh (M9)
rubenxyz
committed
fix(auth): constrain /auth/me/preferences with a schema (M8)
rubenxyz
committed
fix(web): respect NEXT_PUBLIC_BASE_PATH in clearTokens redirect (L3)
rubenxyz
committed
fix(share): import ShareVerifyRequest at module top (unblock FastAPI registration)
rubenxyz
committed
test(share): patch validate_share_link_with_session in share_comments tests
rubenxyz
committed
docs: add SECURITY_AUDIT.md (per-finding write-up for this PR)
rubenxyz
committed